RWG.bz is currently not down any more. ;)

[greg_r]

All,

Yes, RWG is currently offline. We're being hit by a DoS attack. A big one.

More info when I have it, but realistically we're likely to be down for a while.

 

[Kleen]

hhhmmmn....wonder if RWF could be behind this....?

 

[DR3M3L]

Good luck with getting it back up and running Greg! Keep us updated

 

[Pickledbeetroot]

Thought it was just me, good luck Greg

 

[sconehead]

If it is them, we were right with our suspicions...

 

[Steelfish]

Oh shit.....sorry to hear that G.....what a bastard of a thing to happen.

Make yourself at home guys.....you're more than welcome.

 

[Kleen]

I don't know how these things work, so I just assume the obvious answer is a 'no'...but is there any way to trace the origins of such an attack, e.g. country, IP etc...?

 

[greg_r]

If it were a straightforward DoS, then yes, you can see where it's coming from. However, we're being hit by something called a SYN flood, which makes things a lot more difficult to trace as the attacking IP is spoofed. It's the digital equivalent of ringing someone's doorbell and running away - the server never gets the chance to identify the source.

We've been hit several times before, but the current attack is the largest we've ever experienced - we can shrug off low-level attacks without too much difficulty - and have on several occasions - but the sheer volume of this attack makes things that bit more difficult.

 

[Del]

Bummer mate. Hope you can sort this out ok.


Sent from my iPhone using Tapatalk

 

[Kleen]

Ok, thanks for the explanation, Greg.

I wish you best of luck in defending & restoring our home...

 

[Semaj]

Retribution shall be swift and concise

 

[Kleen]

Retribution shall be swift and concise

Yup...but it would be great to run with more than 'a hunch'...

 

[greg_r]

We're back up - at least for now. The attack has slackened off enough that we can handle it. Whether it stays that way is another matter.

 

[thedoover]

When one of these attacks comes in, if too many requests come from the same ip in a short amount of time, I was under the impression that most firewalls will block that ip for a pre-set time period. Is this attack shifting ip's so quickly that they cannot be identified and subsequently blocked? Or is this what makes a SYN attack different?

Im a networking noob.

 

[DR3M3L]

When one of these attacks comes in, if too many requests come from the same ip in a short amount of time, I was under the impression that most firewalls will block that ip for a pre-set time period. Is this attack shifting ip's so quickly that they cannot be identified and subsequently blocked? Or is this what makes a SYN attack different?

Im a networking noob.

Google for botnets SYN

 

[Duzza]

and down again

 

[DR3M3L]

and down again

Read the other topic..........